Outlook vulnerabilities

9 known vulnerabilities in Outlook from Microsoft. 9 are rated high or critical, and 5 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Microsoft Outlook for iOS: Improper Neutralization of Special Elements used in a Command

  CVE-2026-42893May 12, 2026Microsoft

  Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.

• 7.5 High severity

  Microsoft 365 Apps for Enterprise: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-21260Feb 10, 2026MicrosoftEPSS 1.5%

  Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

• 7.5 High severity

  Microsoft Outlook for Android: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2025-29805Apr 8, 2025MicrosoftEPSS 1.59%

  Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network.

• 9.1 Critical severity

  Outlook: Improper Verification of Cryptographic Signature

  CVE-2024-42220Dec 18, 2024Microsoft

  A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. A specially crafted library can leverage Outlook's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigg

• 7.5 High severity

  Microsoft Outlook Security Feature Bypass Exploited

  CVE-2023-35311Jul 11, 2023MicrosoftEPSS 15.5%

  Microsoft Outlook Security Feature Bypass Vulnerability

• 9.8 Critical severity

  Microsoft Office Outlook Privilege Escalation Exploited

  CVE-2023-23397Mar 14, 2023MicrosoftEPSS 97.2%

  Microsoft Outlook Elevation of Privilege Vulnerability

• 7.8 High severity

  Microsoft Office Outlook Security Feature Bypass Exploited

  CVE-2017-11774Oct 13, 2017MicrosoftEPSS 59.6%

  Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

• 7.8 High severity

  Microsoft Office Memory Corruption Exploited

  CVE-2015-1641Apr 14, 2015MicrosoftEPSS 97.2%

  Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 al

• 9.3 High severity

  Microsoft Office Excel Remote Code Execution Exploited

  CVE-2007-0671Feb 3, 2007MicrosoftEPSS 44.1%

  Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero